Hackers Force Continuous Defrost on European Supermarket Fridges
A cyberattack targeting Danfoss refrigeration controls has caused units to run at 50 degrees Celsius, disrupting operations for major chains in France and the Netherlands.
Key points
- Attackers forced Danfoss-made refrigeration units into continuous defrost cycles at 50 degrees Celsius.
- Major French retailers Intermarche, Leclerc, and Cooperative U confirmed operational disruptions.
- Dutch chains Albert Heijn and others suspended websites and loyalty programs following the incident.
Attackers have compromised refrigeration control systems across multiple European supermarket chains, forcing units to operate in continuous defrost mode at elevated temperatures. According to reporting by Tom's Hardware citing La Depêche, the incident disrupted cooling infrastructure for major retailers in France and the Netherlands.
The attack targeted Danfoss-made refrigeration controls, overriding standard settings that typically limit automatic defrosting to two hours daily. Hackers configured the systems to maintain a temperature of 50 degrees Celsius, causing a persistent release of heat from freezers and refrigerators. This manipulation effectively disabled the cooling function for affected stores.
View the original post on X
Operational Impact and Financial Losses
Dominique Schelcher, president of Cooperative U, confirmed on Monday morning that the cyberattack had been affecting refrigeration production facilities since the previous night. He described the incident as extremely serious and noted that teams were mobilized to address the issue while an investigation was launched. Schelcher stated that the attack impacted several stores within the network.
Early estimates suggest financial losses are approaching 300,000 euros, with potential nationwide costs reaching several million euros. The disruption extends beyond refrigeration, as electronic shelf labels were also compromised. This secondary impact disrupted in-store pricing mechanisms and affected delivery logistics for the targeted retailers.
Affected Retailers and Regional Scope
In France, Intermarche, Leclerc, and Cooperative U were identified as targets of the refrigeration system intrusion. In the Netherlands, NOS reported that Albert Heijn, Etos, and Gall & Gall experienced malfunctions linked to a cybersecurity incident on Sunday afternoon. Albert Heijn stated it took immediate measures to protect its IT environment, including the preventive temporary shutdown of several systems.
Delhaize, a Belgian chain owned by Albert Heijn, also reported disruptions. Images from Amsterdam showed stores warning customers about pricing errors and the suspension of loyalty programs. It remains unclear whether the French and Dutch incidents are related or how widespread the total impact is across Europe.
What should you do?
Security professionals and IT administrators should monitor network traffic for unusual commands sent to industrial control systems and IoT devices. Organizations should verify the integrity of firmware on critical infrastructure components, particularly those managing environmental controls. If a compromise is suspected, isolate affected systems immediately to prevent lateral movement.
What to do and how to stay safe: Danfoss
- Monitor network logs for anomalous commands directed at industrial control systems or IoT devices managing environmental functions.
- Verify the integrity of firmware and configuration files on critical infrastructure components to detect unauthorized changes.
- Isolate affected systems from the main network immediately upon suspicion of compromise to prevent lateral movement.
- Review access controls for operational technology networks to ensure only authorized personnel can modify system settings.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which refrigeration manufacturer's systems were targeted in this attack?
The attack targeted refrigeration controls made by Danfoss, which are used by several major European supermarket chains.
How did the hackers manipulate the refrigerator settings?
Hackers configured the automatic defrosting function to run continuously at 50 degrees Celsius, overriding the normal two-hour daily cycle.
Which specific supermarket chains were affected in France?
Intermarche, Leclerc, and Cooperative U were identified as French retailers affected by the refrigeration system cyberattack.
